ClawHub
Back to skill

Security audit

Zyka AI

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent and not malicious, but it needs Review because it can install a mutable global CLI, upload local media, and spend Zyka credits autonomously, including sensitive face and voice features.

Install only if you are comfortable trusting the current npm `zyka` package and Zyka's downstream providers. Use a restricted API key with spending limits, review each command's model, cost, and exact files before running, and do not upload private, proprietary, face, or voice media unless you have clear rights and consent.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:34
Finding

Unpinned Global Installation of a Mutable npm Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:34-39; duplicated in zyka-ai-media.md:13-18
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code

SKILL.md:34-39:

bash
**Required: install the CLI once before using this skill.** All examples below assume `zyka` is on your PATH.

```bash
npm install -g zyka            # one-time install (latest)
zyka --help                    # verify install
text

Equivalent installation instructions appear in `zyka-ai-media.md`:

```bash
Install the CLI once before using:

```bash
npm install -g zyka            # one-time install (latest)
zyka --help                    # verify install
text

### Technical Analysis

The Skill instructs users to install the mutable latest version of the `zyka` npm package globally. It does not pin the dependency to the reviewed Skill version, provide an integrity hash, use a lockfile, or require package signature or provenance verification.

Because the executable implementation is not included in this repository, the security properties of the Skill depend on whatever package version npm resolves at installation time. Global npm installation may also run package lifecycle scripts and places the executable in a system-wide command path. A future compromised, malicious, or unexpectedly changed release could therefore execute code that was not present during this audit.

This is a supply-chain weakness rather than evidence that the current package is malicious. The project identifies an official npm page and source repository, but those references do not make the installed artifact immutable.

### Attack Path

1. An attacker compromises the npm publisher account, package release process, or another component of the package supply chain.
2. The attacker publishes a malicious version under the legitimate `zyka` package name.
3. A user follows the Skill instructi
...[truncated 985 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the CLI to an exact audited version, for example npm install -g zyka@0.4.11, rather than installing latest.
  2. Ensure the pinned CLI version corresponds to the Skill documentation version.
  3. Publish and verify package integrity hashes, signatures, or npm provenance attestations.
  4. Prefer a project-local installation governed by a committed lockfile instead of global installation.
  5. Where compatible with the package, disable lifecycle scripts during installation and explicitly document any scripts that are required.
  6. Warn users not to run the installation with administrator or root privileges.
  7. Review the resolved package contents and dependency tree before updating the pinned version.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:53
Finding

Autonomous Billable API Operations Without Per-Request Confirmation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:53
Vulnerability Type: Excessive autonomous financial and data-transfer authority
Risk Level: Medium

Vulnerable Code

markdown
- **Autonomous use:** this skill is designed for agent-driven invocation. The agent can call Zyka endpoints (and spend credits) without an extra prompt once the skill is enabled. If you want explicit user confirmation per call, run commands interactively rather than relying on autonomous invocation.

Technical Analysis

The Skill explicitly authorizes the agent to invoke billable Zyka endpoints without obtaining confirmation for each operation. These invocations may also upload referenced images, audio, or video to Zyka and downstream model providers.

Network access and media transfer are necessary for the declared cloud media-generation functionality. However, allowing an agent to spend credits and transfer user content based solely on the Skill being enabled exceeds the minimum privilege needed to construct commands or request authorization for a specific generation job.

The disclosure reduces surprise but does not technically constrain spending, request frequency, selected files, or downstream providers. Ambiguous instructions, repeated agent execution, or attacker-influenced content could therefore trigger unintended operations under the authority of the configured API key.

Attack Path

  1. The user enables the Skill and configures a valid ZYKA_API_KEY.
  2. The agent receives an ambiguous, repeated, or attacker-influenced media-generation request.
  3. Following the Skill instructions, the agent executes zyka generate without presenting a final confirmation.
  4. The CLI authenticates using the API key and uploads any referenced media needed by the selected operation.
  5. Zyka and potentially downstream model providers process the request.
  6. Credits are consumed and user media is disclosed before the user approves t ...[truncated 782 chars]
Remediation
View remediation

Remediation Suggestions

  1. Require explicit user confirmation immediately before every billable API invocation.
  2. Before confirmation, display the operation, model/provider, estimated cost, number of outputs, and exact local files that will be uploaded.
  3. Require renewed confirmation when a request changes providers, adds files, increases resolution or duration, or retries a failed job.
  4. Add configurable per-request, daily spending, and request-count limits.
  5. Prevent automatic retries from creating duplicate billable jobs unless the user approves them.
  6. Use restricted API keys with the smallest available spending limits and capabilities.
  7. Provide a local dry-run mode that prints the command and anticipated data flow without submitting it.
  8. Preserve the existing privacy warning while making confirmation the default rather than an interactive-only option.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.

Generate from text:

bash
zyka generate image -m gpt_image_1 -p "A neon cyberpunk cityscape" -o ./city.png

Edit an existing image:

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · zyka-ai-media.md (reported line 145)May include surrounding context.

Generate from text:

bash
zyka generate image -m gpt_image_1 -p "A neon cyberpunk cityscape" -o ./city.png

Edit an existing image:

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 187)May include surrounding context.

Transparent background:

bash
zyka generate image -m gpt_image_1 -p "product photo of sneakers" --background transparent -o ./sneakers.png

Grok image:

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · zyka-ai-media.md (reported line 160)May include surrounding context.

Transparent background:

bash
zyka generate image -m gpt_image_1 -p "product photo of sneakers" --background transparent -o ./sneakers.png

Grok image:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill documents voice cloning and face swap functionality without any consent, impersonation, or biometric-data safety guidance. These capabilities materially increase abuse potential for non-consensual deepfakes, impersonation, harassment, and misuse of sensitive biometric media, making the omission dangerous in this context.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest frames the skill as generating AI videos, images, voice, and using AI apps like upscale, face swap, captions, and dubbing. The documented createYouTubeDownloader() capability and corresponding zyka generate youtube-download command perform generic media downloading from YouTube, which is not an obvious or necessary part of AI media generation or the listed app categories.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs users to pass local image, audio, and video files and states they are auto-uploaded, but it does not prominently warn that potentially sensitive local media will be transmitted to a third-party service. This can lead to unintended disclosure of private, proprietary, or biometric content, especially because the instructions normalize direct file submission from local disk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The examples hard-code Hindi and Tamil as output languages for video dubbing, which can steer agents toward a specific locale without an explicit user preference. Under the language/locale policy, skills should avoid forcing a language choice unless the user opts in or the regional constraint is clearly justified.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The manifest emphasizes creating AI-generated media and media-processing apps such as captions and dubbing. createVideoToScript() and the video-to-script CLI command convert existing video into textual script output, which is a broader content extraction/transcription capability rather than media generation or the specifically named app types.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.